Skip to content

One new activestorage advisory - #1300

Open
jasnow wants to merge 4 commits into
rubysec:masterfrom
jasnow:nov-4b-advs
Open

jasnow wants to merge 4 commits into
rubysec:masterfrom
jasnow:nov-4b-advs

Conversation

@jasnow

@jasnow jasnow commented Nov 4, 2026

Copy link
Copy Markdown
Member

One new activestorage advisory

@simi

simi commented Nov 5, 2026

Copy link
Copy Markdown
Contributor

Is that actually gems/activestorage/GHSA-f3w6-w445-fwh9.yml?

@flavorjones

Copy link
Copy Markdown
Member

@simi Looks like it ... what a fucking shitshow the reporting situation is right now.

@jasnow

jasnow commented Nov 6, 2026 •

Copy link
Copy Markdown
Member Author

Updated one advisory and deleted dup advisory - add dup to ignore file - upgraded python in GHA script.

@jasnow
jasnow requested a review from simi November 7, 2026 13:46

@flavorjones flavorjones left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems fine, though I wonder if we'll get another CVE for this if/when github finally assigns one to the original GHSA. 🤷‍♂

@jasnow

jasnow commented Nov 10, 2026

Copy link
Copy Markdown
Member Author

Seems fine, though I wonder if we'll get another CVE for this if/when github
finally assigns one to the original GHSA. 🤷‍♂

I vote to wait until that happens and deal with it then.

@flavorjones

Copy link
Copy Markdown
Member

Hilarious, github just assigned CVE-2026-126082. 🤷‍♂

@jasnow

jasnow commented Nov 11, 2026

Copy link
Copy Markdown
Member Author

CVE-2026-126082

Therefore it is a duplicate of CVE-2026-126082 and will be add to the rad-ignores file.

Added comments regarding CVE-2026-126082 and its duplicate.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants